PT-2011-2365 · Linux+1 · Linux Kernel+1

Goldwyn Rodrigues · Publicado 2011-04-10 · Atualizado 2020-08-04 · CVE-2011-0463

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 2.6.39-rc1

Description The issue is related to the ocfs2 prepare page for write function in the Oracle Cluster File System 2 (OCFS2) subsystem, which does not properly handle holes that cross page boundaries. This allows local users to obtain potentially sensitive information from uninitialized disk locations by reading a file.

Recommendations For versions prior to 2.6.39-rc1, update to version 2.6.39-rc1 or later to resolve the issue.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2011-0463

Produtos afetados

Linux Kernel

Ocfs2

Referências · 7

• 🔥 http://oss.oracle.com/pipermail/ocfs2-devel/2011-February/007846.html · Exploit
• 🔥 https://bugzilla.novell.com/show_bug.cgi?id=673037 · Exploit
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=272b62c1f0f6f742046e45b50b6fec98860208a0 · Nota
• http://ubuntu.com/usn/USN-1146-1 · Aviso do Fabricante
• http://secunia.com/advisories/43966 · Nota
• http://kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.39-rc1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-0463 · Nota de Segurança